![\"Timeline](\"https:\/\/aec.llc\/blog\/wp-content\/uploads\/2026\/03\/17-1024x683.png\")
<\/figure>\n\n\n\nThe 2019 Edition Changed the BIA Review Equation<\/h2>\n\n\n\n
The 2012 edition implied that BIA adequacy should be evaluated. The 2019 edition made it explicit. Clause 8.6 now requires the organisation to evaluate the suitability, adequacy, and effectiveness of its BIA and risk assessment. ISOQAR, a UKAS-accredited certification body, confirms in July 2025 guidance that this was “previously only an implicit requirement in the name of effectiveness.”<\/p>\n\n\n\n
That distinction matters at surveillance. Under the 2012 edition, an auditor questioning a stale BIA was arguing from inference \u2014 the standard didn’t directly require evaluation of BIA fitness. Under the 2019 edition, the auditor has Clause 8.6 as a direct mechanism. A BIA that exists, is version-controlled, and was formally “reviewed” but demonstrably misrepresents current operations \u2014 RTOs referencing decommissioned systems, dependencies mapped to terminated supplier contracts, prioritised activities owned by teams that were restructured out of existence \u2014 is now a legitimate finding against a named clause.<\/p>\n\n\n\n
The question shifts from “was the BIA reviewed?” to “is the BIA fit for purpose?” The second question is harder to answer with an annual rubber stamp.<\/p>\n\n\n\n
Where the Stale BIA Actually Breaks<\/h2>\n\n\n\n
The damage propagates downstream. Clause 8.2.3 requires the risk assessment to assess disruption risks to the prioritised activities identified by the BIA. If the BIA is stale, the risk assessment is built on invalidated foundations. Both documents arrive at surveillance with matching dates and matching approvals \u2014 and matching disconnection from current operations.<\/p>\n\n\n\n
Clause 9.1 makes the gap wider. Performance evaluation requires the organisation to determine what to monitor and measure, and to retain documented evidence of results. Most organisations track exercise completion rates and incident response metrics. Almost none include BIA currency as a performance indicator. The BIA sits outside the measurement framework entirely \u2014 formally maintained, operationally unchecked.<\/p>\n\n\n\n
Here is what that looks like in practice: the BCMS manager updates the BIA in the four to six weeks before the surveillance visit. IT infrastructure changed eight months ago. A key supplier was replaced six months ago. A business unit was restructured four months ago. The BCMS manager discovers these changes during pre-audit preparation \u2014 or the external auditor discovers them first.<\/p>\n\n\n\n
Clause references for 8.2.3 and 9.1 reflect mapped standard requirements. Verify against current edition before audit use.<\/p>\n\n\n\n Moving from a static BIA to a maintained one takes infrastructure, not willpower.<\/p>\n\n\n\n First, age the existing BIA. Map every prioritised activity to its current operational owner. Verify every dependency \u2014 supplier, system, location \u2014 is still active. Confirm every RTO against current recovery capabilities, not the capabilities that existed at certification. Document every discrepancy. The output is a gap register that quantifies drift.<\/p>\n\n\n\n Second, define the trigger mechanism. ISOQAR’s July 2025 CB guidance states that BC arrangements should be “reviewed and updated whenever there is a significant change in your operational environment, structure, locations, personnel, processes or technology, or when an exercise or incident highlights deficiencies.” That translates into a trigger register: organisational restructure, new or discontinued product\/service lines, material supplier changes, IT infrastructure migration, site relocation, post-exercise findings of RTO infeasibility, and M&A activity. Assign cross-functional ownership \u2014 HR notifies on restructures, IT on infrastructure changes, Procurement on supplier substitutions.<\/p>\n\n\n\n Third, add BIA currency to the Clause 9.1 performance framework. Track date of last BIA review, date of last material operational change, number of open BIA discrepancies, and date of last dependency verification. Include BIA currency as a standing management review agenda item under Clause 9.3.<\/p>\n\n\n\n Fourth, expand internal audit scope. Audit BIA accuracy against current operations \u2014 not only document existence and version control. Interview operational line managers, not only the BCMS owner. A BIA that is formally approved and version-controlled but operationally inaccurate is still a conformance problem under Clause 8.6.<\/p>\n\n\n\n ISO 22301:2019 requires the BIA to be reviewed. It does not require the BIA to be right. The standard’s silence on frequency, trigger thresholds, and staleness criteria means organisations can satisfy the review obligation with an annual sign-off that never interrogates whether the documented recovery priorities still match the organisation’s actual operations.<\/p>\n\n\n\n Clause 8.6 gives auditors the instrument to challenge that approach. The question at surveillance is no longer whether the BIA was reviewed on schedule. It’s whether the BIA would actually work if you activated it tomorrow.<\/p>\n\n\n\n AEC International provides ISO certification, training, and consultancy services at the intersection of business continuity, resilience, and operational risk management. We support organisations across industries in achieving and maintaining ISO certification \u2014 from gap analysis and implementation through audit preparation and continual improvement.<\/p>\n\n\n\n![\"Flowchart](\"https:\/\/aec.llc\/blog\/wp-content\/uploads\/2026\/03\/16-1024x683.png\")
<\/figure>\n\n\n\nBuilding a BIA Review Process That Stays Current<\/h2>\n\n\n\n
![\"Example](\"https:\/\/aec.llc\/blog\/wp-content\/uploads\/2026\/03\/18-1024x683.png\")
<\/figure>\n\n\n\nThe Core Problem With ISO 22301 BIA Review<\/h2>\n\n\n\n
About AEC International<\/h2>\n\n\n\n